danshapiro · danshapiro · Aug 26, 2026 · Aug 26, 2026 · Aug 27, 2026 · Aug 27, 2026
diff --git a/.dockerignore b/.dockerignore
@@ -1,4 +1,5 @@
 # Build artifacts (rebuilt in Docker — never copy from host)
+.worktrees/
 node_modules/
 dist/
 target/
@@ -7,6 +8,12 @@ playwright-report/
 coverage/
 .nyc_output/
 
+# Retired backend source/test roots must not enter the Rust-only source image.
+/server/
+/test/server/
+/test/unit/server/
+/test/integration/server/
+
 # Version control and CI
 .git/
 .github/
@@ -27,7 +34,6 @@ coverage/
 docs/plans/
 docs/development/
 installers/
-electron/
 examples/
 # port/ stays excluded (7.4M oracle corpus belongs to the config-excluded
 # vitest.port.config.ts suites), EXCEPT the tiny 80K fixture dir the
@@ -41,6 +47,85 @@ port/oracle/*
 !port/oracle/baselines/
 port/oracle/baselines/*
 !port/oracle/baselines/mode-preamble/
+!port/laptop-bootstrap/
+port/laptop-bootstrap/*
+!port/laptop-bootstrap/1-install-wsl.cmd
+!port/laptop-bootstrap/2-bootstrap-wsl.sh
+!port/vm-bridge/
+port/vm-bridge/*
+!port/vm-bridge/agent-console-vm.ps1
+!port/vm-bridge/agent-console-wsl.sh
+
+# The Cloud Run default Vitest lane reads these checked-in runtime and
+# distribution surfaces. Keep the exact manifest-owned inputs in the image
+# even though their surrounding directories are not application runtime data.
+!.github/
+.github/*
+!.github/workflows/
+.github/workflows/*
+!.github/workflows/docs-pages-deploy.yml
+!.github/workflows/electron-build.yml
+!.github/workflows/electron-release.yml
+!.github/workflows/port-contract.yml
+!.github/workflows/rust-clippy.yml
+!.github/workflows/typecheck-client.yml
+
+# Only the root app sources; test/**/electron contains runtime evidence.
+/electron/*
+!/electron/port-check.ts
+
+!examples/
+examples/*
+!examples/docker/
+examples/docker/*
+!examples/docker/Dockerfile
+!examples/extensions/
+examples/extensions/*
+!examples/extensions/live-counter/
+examples/extensions/live-counter/*
+!examples/extensions/live-counter/server.js
+!examples/extensions/status-dashboard/
+examples/extensions/status-dashboard/*
+!examples/extensions/status-dashboard/server.js
+
+!installers/
+installers/*
+!installers/systemd/
+installers/systemd/*
+!installers/systemd/freshell-rust.service
+
+# Distribution guard fixtures are checked in and needed by the default
+# Cloud Run lane. Re-include only the six controls; sibling dist/node_modules
+# files remain excluded.
+!test/fixtures/distribution/rust-only/dist/
+test/fixtures/distribution/rust-only/dist/*
+!test/fixtures/distribution/rust-only/dist/client/
+test/fixtures/distribution/rust-only/dist/client/*
+!test/fixtures/distribution/rust-only/dist/client/index.html
+!test/fixtures/distribution/rust-only/dist/tools/
+test/fixtures/distribution/rust-only/dist/tools/*
+!test/fixtures/distribution/rust-only/dist/tools/freshell-mcp/
+test/fixtures/distribution/rust-only/dist/tools/freshell-mcp/*
+!test/fixtures/distribution/rust-only/dist/tools/freshell-mcp/server.js
+!test/fixtures/distribution/node-server/dist/
+test/fixtures/distribution/node-server/dist/*
+!test/fixtures/distribution/node-server/dist/client/
+test/fixtures/distribution/node-server/dist/client/*
+!test/fixtures/distribution/node-server/dist/client/index.html
+!test/fixtures/distribution/node-server/dist/server/
+test/fixtures/distribution/node-server/dist/server/*
+!test/fixtures/distribution/node-server/dist/server/index.js
+!test/fixtures/distribution/node-server/dist/tools/
+test/fixtures/distribution/node-server/dist/tools/*
+!test/fixtures/distribution/node-server/dist/tools/freshell-mcp/
+test/fixtures/distribution/node-server/dist/tools/freshell-mcp/*
+!test/fixtures/distribution/node-server/dist/tools/freshell-mcp/server.js
+!test/fixtures/distribution/node-server/node_modules/
+test/fixtures/distribution/node-server/node_modules/*
+!test/fixtures/distribution/node-server/node_modules/node-pty/
+test/fixtures/distribution/node-server/node_modules/node-pty/*
+!test/fixtures/distribution/node-server/node_modules/node-pty/index.js
+
 assets/
 
 # Editor / IDE

diff --git a/.env.example b/.env.example
@@ -12,37 +12,24 @@ AUTH_TOKEN=replace-with-a-long-random-token
 # Server
 # -----------------------------------------------------------------------------
 
-# Port for the Express server (backend API + production static files)
+# Port for the Rust freshell-server (HTTP, WebSocket, and static client files)
 PORT=3001
 
-# Set to true to hide AUTH_TOKEN from the startup URL printed to the console.
-# Useful when logs are aggregated or terminals are shared/recorded.
-# HIDE_STARTUP_TOKEN=true
+# Rust log filter (standard `tracing` syntax; default: info).
+# RUST_LOG=info
 
-# Log level: fatal, error, warn, info, debug, trace
-# LOG_LEVEL=debug
+# Optional explicit bind host for the Rust service. Without this, the server
+# uses persisted network settings and platform defaults.
+# FRESHELL_BIND_HOST=127.0.0.1
 
-# Trust proxy setting for Express (e.g., "1", "loopback", or a CIDR range).
-# Set this when running behind a reverse proxy (nginx, Caddy, Cloudflare).
-# FRESHELL_TRUST_PROXY=1
-
-# ALLOWED_ORIGINS is auto-managed by NetworkManager based on bind host and LAN IPs.
+# ALLOWED_ORIGINS is auto-managed from the active bind host and LAN IPs.
 # Do not edit manually — use EXTRA_ALLOWED_ORIGINS for custom additions.
 # ALLOWED_ORIGINS=http://localhost:3001,http://127.0.0.1:3001
 
 # Extra origins to allow (for reverse proxies, custom domains, etc.).
 # These are preserved across NetworkManager reconfigurations.
 # EXTRA_ALLOWED_ORIGINS=http://localhost:5173,http://localhost:3002,https://mysite.com,http://192.168.1.50:8080
 
-# Maximum concurrent WebSocket connections (default: 50)
-# MAX_CONNECTIONS=50
-
-# Maximum concurrent terminals (default: 50)
-# MAX_TERMINALS=50
-
-# Scrollback buffer size in characters per terminal (default: 65536 = 64KB)
-# MAX_SCROLLBACK_CHARS=65536
-
 # -----------------------------------------------------------------------------
 # Vite Dev Server (only used during `npm run dev`)
 # -----------------------------------------------------------------------------
@@ -75,21 +62,26 @@ PORT=3001
 # Override the Claude CLI command (default: claude)
 # CLAUDE_CMD=claude
 
+# Rust fresh-agent Claude panes use this isolated Node SDK sidecar. These are
+# normally set by Electron or the development launcher; set them explicitly
+# only when running the Rust service with a custom sidecar installation.
+# FRESHELL_CLAUDE_NODE=/path/to/node
+# FRESHELL_CLAUDE_SIDECAR=/path/to/crates/freshell-claude-sidecar/index.mjs
+
 # Override path to Codex's home directory (default: ~/.codex)
 # CODEX_HOME=/path/to/.codex
 
 # Override the Codex CLI command (default: codex)
 # CODEX_CMD=codex
 
+# Standalone MCP client overrides. Set both values together when running the
+# MCP client outside a built checkout or packaged Electron application.
+# FRESHELL_MCP_NODE=/path/to/node
+# FRESHELL_MCP_ENTRY=/path/to/dist/tools/freshell-mcp/server.js
+
 # Override Claude autocompact threshold percentage
 # CLAUDE_AUTOCOMPACT_PCT_OVERRIDE=80
 
-# Max events to load per coding CLI session (default: 10000)
-# FRESHELL_MAX_SESSION_EVENTS=10000
-
-# How long to keep completed session data in memory, ms (default: 1800000 = 30 min)
-# FRESHELL_COMPLETED_SESSION_RETENTION_MS=1800000
-
 # -----------------------------------------------------------------------------
 # Windows / WSL (only needed when running on Windows or under WSL)
 # -----------------------------------------------------------------------------
@@ -119,11 +111,8 @@ PORT=3001
 # WebSocket ping interval in ms (default: 30000)
 # PING_INTERVAL_MS=30000
 
-# Max WebSocket buffered bytes before backpressure (default: 2097152 = 2MB)
-# MAX_WS_BUFFERED_AMOUNT=2097152
-
-# Max bytes per WebSocket output chunk (default: 512000 = 500KB)
-# MAX_WS_CHUNK_BYTES=512000
+# Maximum inbound WebSocket frame size in bytes (default: 16777216 = 16MB)
+# WS_MAX_PAYLOAD_BYTES=16777216
 
 # Terminal stream replay ring bytes per terminal (default: 262144 = 256KB)
 # TERMINAL_REPLAY_RING_MAX_BYTES=262144
@@ -143,18 +132,3 @@ PORT=3001
 # Terminal creation rate limit: max creates per window (default: 10 per 10s)
 # TERMINAL_CREATE_RATE_LIMIT=10
 # TERMINAL_CREATE_RATE_WINDOW_MS=10000
-
-# Max exited terminals to keep in memory (default: 200)
-# MAX_EXITED_TERMINALS=200
-
-# Sessions sync coalesce interval in ms (default: 150)
-# SESSIONS_SYNC_COALESCE_MS=150
-
-# Claude indexer debounce interval in ms (default: 250)
-# CLAUDE_INDEXER_DEBOUNCE_MS=250
-
-# Max seen session IDs to cache (default: 10000)
-# CLAUDE_SEEN_SESSION_MAX=10000
-
-# How long to remember seen session IDs, ms (default: 604800000 = 7 days)
-# CLAUDE_SEEN_SESSION_RETENTION_MS=604800000
diff --git a/.gcloudignore b/.gcloudignore
@@ -7,6 +7,12 @@ playwright-report/
 coverage/
 .nyc_output/
 
+# Retired backend source/test roots must not enter the Rust-only source image.
+/server/
+/test/server/
+/test/unit/server/
+/test/integration/server/
+
 # Version control and CI
 .git/
 .github/
@@ -28,7 +34,6 @@ coverage/
 docs/plans/
 docs/development/
 installers/
-electron/
 examples/
 # port/ stays excluded (7.4M oracle corpus belongs to the config-excluded
 # vitest.port.config.ts suites), EXCEPT the tiny 80K fixture dir the
@@ -42,6 +47,85 @@ port/oracle/*
 !port/oracle/baselines/
 port/oracle/baselines/*
 !port/oracle/baselines/mode-preamble/
+!port/laptop-bootstrap/
+port/laptop-bootstrap/*
+!port/laptop-bootstrap/1-install-wsl.cmd
+!port/laptop-bootstrap/2-bootstrap-wsl.sh
+!port/vm-bridge/
+port/vm-bridge/*
+!port/vm-bridge/agent-console-vm.ps1
+!port/vm-bridge/agent-console-wsl.sh
+
+# The Cloud Run default Vitest lane reads these checked-in runtime and
+# distribution surfaces. Keep the exact manifest-owned inputs in the image
+# even though their surrounding directories are not application runtime data.
+!.github/
+.github/*
+!.github/workflows/
+.github/workflows/*
+!.github/workflows/docs-pages-deploy.yml
+!.github/workflows/electron-build.yml
+!.github/workflows/electron-release.yml
+!.github/workflows/port-contract.yml
+!.github/workflows/rust-clippy.yml
+!.github/workflows/typecheck-client.yml
+
+# Only the root app sources; test/**/electron contains runtime evidence.
+/electron/*
+!/electron/port-check.ts
+
+!examples/
+examples/*
+!examples/docker/
+examples/docker/*
+!examples/docker/Dockerfile
+!examples/extensions/
+examples/extensions/*
+!examples/extensions/live-counter/
+examples/extensions/live-counter/*
+!examples/extensions/live-counter/server.js
+!examples/extensions/status-dashboard/
+examples/extensions/status-dashboard/*
+!examples/extensions/status-dashboard/server.js
+
+!installers/
+installers/*
+!installers/systemd/
+installers/systemd/*
+!installers/systemd/freshell-rust.service
+
+# Distribution guard fixtures are checked in and needed by the default
+# Cloud Run lane. Re-include only the six controls; sibling dist/node_modules
+# files remain excluded.
+!test/fixtures/distribution/rust-only/dist/
+test/fixtures/distribution/rust-only/dist/*
+!test/fixtures/distribution/rust-only/dist/client/
+test/fixtures/distribution/rust-only/dist/client/*
+!test/fixtures/distribution/rust-only/dist/client/index.html
+!test/fixtures/distribution/rust-only/dist/tools/
+test/fixtures/distribution/rust-only/dist/tools/*
+!test/fixtures/distribution/rust-only/dist/tools/freshell-mcp/
+test/fixtures/distribution/rust-only/dist/tools/freshell-mcp/*
+!test/fixtures/distribution/rust-only/dist/tools/freshell-mcp/server.js
+!test/fixtures/distribution/node-server/dist/
+test/fixtures/distribution/node-server/dist/*
+!test/fixtures/distribution/node-server/dist/client/
+test/fixtures/distribution/node-server/dist/client/*
+!test/fixtures/distribution/node-server/dist/client/index.html
+!test/fixtures/distribution/node-server/dist/server/
+test/fixtures/distribution/node-server/dist/server/*
+!test/fixtures/distribution/node-server/dist/server/index.js
+!test/fixtures/distribution/node-server/dist/tools/
+test/fixtures/distribution/node-server/dist/tools/*
+!test/fixtures/distribution/node-server/dist/tools/freshell-mcp/
+test/fixtures/distribution/node-server/dist/tools/freshell-mcp/*
+!test/fixtures/distribution/node-server/dist/tools/freshell-mcp/server.js
+!test/fixtures/distribution/node-server/node_modules/
+test/fixtures/distribution/node-server/node_modules/*
+!test/fixtures/distribution/node-server/node_modules/node-pty/
+test/fixtures/distribution/node-server/node_modules/node-pty/*
+!test/fixtures/distribution/node-server/node_modules/node-pty/index.js
+
 assets/
 
 # Editor / IDE